A fast rule matching method and device for traffic analysis

Abstract

The application discloses a fast rule matching method and device for flow analysis, and the method comprises the following steps: obtaining the corresponding code of each IP network segment according to the IP network segment in the address group in the rule set; determining the code set corresponding to each IP network segment according to the mask length of the IP network segment and the containing relationship between the network segments; storing all the code sets into a memory area to obtain the mapping relationship between the IP network segment and the memory offset; constructing a longest prefix matching (LPM) table; in response to the received flow information, querying the LPM table for the source IP address and the destination IP address of the flow information respectively to obtain the memory offset; reading the memory area indicated by the memory offset to obtain the code set matched by the source IP address and the destination IP address respectively; and determining the rule in the rule set matched by the flow information according to the code set. The application can accurately classify the data packet into the corresponding rule, avoid the wrong classification of the data packet, improve the accuracy and effectiveness of the network data processing, and further improve the network management and operation efficiency.

Description

Technical Field

[0001] The invention relates to the field of network technology, and in particular to a fast rule matching method and apparatus for traffic analysis. Background Technology

[0002] With the rapid development of network technology, the amount of network data has increased dramatically. In network management and data processing, it is often necessary to configure rules and then determine which rule a flow belongs to by analyzing its source and destination IP addresses. The common practice is to iterate through the network segments of each rule's IP address group, summarizing all matching IP address groups. When there are many rules, and the IP network segments within a rule or between different rules overlap or duplicate, multiple more tedious matches are required to determine which rules a flow belongs to. Summary of the Invention

[0003] The main technical problems solved by this invention include: how to overcome the problems in the prior art where network flow requires high computing power and rule matching in the rule set requires multiple operations.

[0004] In a first aspect, embodiments of the present invention provide a fast rule matching method for traffic analysis, the method comprising: Based on the IP network segments in the address group of the rule set, the code corresponding to each IP network segment is obtained. The code is used to indicate the address group and rule belonging information to which the IP network segment belongs. Based on the mask length of the IP network segment and the inclusion relationship between the segments, determine the encoding set corresponding to each IP network segment, store all the encoding sets in the memory area, and obtain the mapping relationship between the IP network segment and the memory offset; Construct a longest prefix matching (LPM) table, wherein each entry in the LPM table is used to indicate the memory offset corresponding to the memory region; In response to the received stream information, the LPM table is queried for the source IP address and destination IP address of the stream information respectively to obtain the memory offset. The memory region indicated by the memory offset is read to obtain the encoding set that matches the source IP address and the destination IP address respectively. Based on the encoding set, the rule in the rule set that matches the stream information is determined.

[0005] In a specific embodiment of the present invention, obtaining the encoding corresponding to each IP network segment based on the IP network segments in the address group of the rule set includes: The encoding is performed using a bitmap, which includes four binary bits. The highest bit in the bitmap represents the inversion of the address group. If the IP address to be matched matches the IP network segment in the address group, it indicates a match; otherwise, it indicates a match. The remaining bits in the bitmap represent the address group to which the IP network segment belongs. When different rules in the rule set or different address groups in the same rule contain the exact same IP network segment, the identical IP network segments are merged into one IP network segment. The encoding of the IP network segment includes the bitwise OR operation result of the encodings of all the merged identical IP network segments.

[0006] In a specific embodiment of the present invention, determining the encoding set corresponding to each IP network segment based on the mask length of the IP network segment and the inclusion relationship between the network segments includes: IP network segments with the same mask are placed in the same first linked list to obtain at least one first linked list. Each node in the first linked list stores the IP network segment and the code corresponding to the IP network segment. Traverse all of the first linked lists, and inherit the encoding of the corresponding short-mask IP network segment from the long-mask IP network segment with an inclusion relationship, to obtain the encoding set corresponding to each IP network segment.

[0007] In a specific embodiment of the present invention, it further includes: Establish a reverse linked list, wherein the nodes of the reverse linked list record the encoding of the address group in the rule with the reverse mark, and the reverse mark is the position bit in the encoding that indicates the reverse state.

[0008] In a specific embodiment of the present invention, it further includes: Query the inverted linked list, adjust the encoding set according to the inverted code, and remove the code if the code in the encoding set points to the same rule and address group as the inverted code in the inverted linked list. If there is no code in the encoding set that corresponds to the inverted code in the inverted linked list, then the inverted code is added.

[0009] In a specific embodiment of the present invention, determining the rules in the rule set that the stream information matches based on the encoding set includes: For the single address group mode, if the encoding set of the source IP address or destination IP address of the flow information contains the encoding corresponding to the rule, then it is determined that the rule is matched; For the dual-address group mode, if the encoding sets of the source IP address and the destination IP address of the flow information both contain the encoding of the rule, then the encoding of the source IP and the encoding of the destination IP are bitwise ORed. If the result value is greater than or equal to 3, then it is determined that the rule is matched.

[0010] In a specific embodiment of the present invention, the longest prefix matching (LPM) table is constructed, including: All IP network segments are added to the LPM table. The next hop of each node in the LPM table stores the memory offset. The encoding set corresponding to each IP network segment is obtained through the memory offset and the initial pointer. The tail node in the LPM table points to the memory offset corresponding to the inverted code in the inverted linked list.

[0011] Secondly, embodiments of the present invention provide a fast rule matching device for traffic analysis, the device comprising: The first processing module is used to obtain the code corresponding to each IP network segment based on the IP network segments in the address group of the rule set. The code is used to indicate the address group and rule belonging information to which the IP network segment belongs. The second processing module is used to determine the encoding set corresponding to each IP network segment based on the mask length of the IP network segment and the inclusion relationship between the network segments, store all the encoding sets in the memory area, and obtain the mapping relationship between the IP network segment and the memory offset; The third processing module is used to construct the longest prefix matching (LPM) table, wherein the entries of the LPM table are used to indicate the memory offset of the corresponding memory region; The fourth processing module is used to respond to the received stream information by querying the LPM table for the source IP address and destination IP address of the stream information respectively, obtaining the memory offset, reading the memory region indicated by the memory offset, obtaining the encoding set that matches the source IP address and the destination IP address respectively, and determining the rule in the rule set that matches the stream information based on the encoding set.

[0012] In a specific embodiment of the present invention, the first processing module is used to encode using a bitmap. The bitmap includes four binary bits, wherein the highest bit in the bitmap represents the inversion of the address group, indicating that the IP address to be matched matches the IP network segment in the address group, indicating a miss, otherwise indicating a hit. The remaining bits in the bitmap represent the address group to which the IP network segment belongs. When different rules in the rule set or different address groups in the same rule contain the exact same IP network segment, the identical IP network segments are merged into one IP network segment. The encoding of the IP network segment includes the bitwise OR operation result of the encodings of all the merged identical IP network segments.

[0013] In a specific embodiment of the present invention, the second processing module is used to put IP network segments with the same mask into the same first linked list, thereby obtaining at least one first linked list, wherein each node in the first linked list stores the IP network segment and the code corresponding to the IP network segment; Traverse all of the first linked lists, and inherit the encoding of the corresponding short-mask IP network segment from the long-mask IP network segment with an inclusion relationship, to obtain the encoding set corresponding to each IP network segment.

[0014] In a specific embodiment of the present invention, the second processing module is used to establish a reverse linked list, wherein the nodes of the reverse linked list record the encoding of the address group in the rule with the reverse mark, and the reverse mark is the position bit in the encoding that indicates the reverse state.

[0015] In a specific embodiment of the present invention, the second processing module is used to query the inverted linked list, adjust the encoding set according to the inverted code, and remove the code if the code in the encoding set and the inverted code in the inverted linked list point to the same rule and address group. If there is no code in the encoding set that corresponds to the inverted code in the inverted linked list, then the inverted code is added.

[0016] In a specific embodiment of the present invention, the fourth processing module is used to determine that the rule is matched if the encoding set of the source IP address or destination IP address of the flow information contains the encoding corresponding to the rule for the single address group mode. For the dual-address group mode, if the encoding sets of the source IP address and the destination IP address of the flow information both contain the encoding of the rule, then the encoding of the source IP and the encoding of the destination IP are bitwise ORed. If the result value is greater than or equal to 3, then it is determined that the rule is matched.

[0017] In a specific embodiment of the present invention, the third processing module is used to add all the IP network segments to the LPM table. The next hop of each node in the LPM table stores the memory offset. The encoding set corresponding to each IP network segment is obtained through the memory offset and the initial pointer. The tail node in the LPM table points to the memory offset corresponding to the inverted code in the inverted linked list.

[0018] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the fast rule matching method for traffic analysis.

[0019] Fourthly, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the fast rule matching method for traffic analysis as described above.

[0020] Compared with existing technologies, the present invention has the following outstanding advantages: Users can customize rules according to their actual needs to meet the network management and data processing requirements in different scenarios. For example, enterprise internal networks can divide network rules according to departmental functions, or network security protection can set independent rules for specific threat sources. By accurately matching IP addresses and network segments, combined with various matching rules, such as single address matching, dual address matching, and inversion marking, data packets can be accurately classified into the corresponding rules, avoiding misclassification of data packets, improving the accuracy and effectiveness of network data processing, and thus enhancing network management and operational efficiency. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A schematic diagram of the address group encoding in the rules of the fast rule matching method for traffic analysis provided by the present invention; Figure 2 This is a schematic diagram of the linked list corresponding to the rules in the fast rule matching method for traffic analysis according to an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the inheritance relationship encoded in the linked list according to an embodiment of the present invention; Figure 4 This is a schematic diagram summarizing the encoding of an embodiment of the present invention; Figure 5 A schematic diagram of the cache structure of the encoding set provided by the present invention; Figure 6 This is a schematic diagram illustrating the correspondence between LPM and cache structure in an embodiment of the present invention; Figure 7 This is a schematic diagram of the matching determination process according to an embodiment of the present invention; Figure 8 This is a schematic diagram summarizing the encoding of an embodiment of the present invention; Figure 9 This is a flowchart illustrating the fast rule matching method for traffic analysis according to an embodiment of the present invention; Figure 10 This is a schematic diagram of a fast rule matching device for traffic analysis according to an embodiment of the present invention; Figure 11 This is a schematic diagram of a device according to an embodiment of the present invention. Detailed Implementation

[0022] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0023] It should also be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0024] It should also be understood that, in various embodiments of the present invention, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0025] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0026] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0027] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0028] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0029] To make the above-mentioned features and effects of the present invention clearer and easier to understand, specific embodiments are described below in conjunction with the accompanying drawings. This specification discloses one or more embodiments incorporating the features of the present invention. The disclosed embodiments are merely illustrative. The scope of protection of the present invention is not limited to the disclosed embodiments, but is defined by the appended claims.

[0030] The following are system embodiments corresponding to the above method embodiments. This embodiment can be implemented in conjunction with the above embodiments. The relevant technical details mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments.

[0031] In a network flow classification and rule matching system, administrators can configure rules to determine which rule a flow should belong to based on its source and destination IP addresses. The core of each rule consists of address groups, and each rule can contain one or two address groups.

[0032] Address groups are logical units of IP addresses and can be formed by any combination of the following three forms: single IP address (e.g., 10.0.0.1); IP address range (Classless Inter-Domain Routing (CIDR) format) (e.g., 10.0.0.0 / 16); IP address range (e.g., 10.0.0.1-10.0.0.4). In addition, each address group can be configured with an inverted flag; when the flag is true, it indicates that the group matches all IP addresses except the specified IP address within the group.

[0033] The matching method for a rule depends on the number of address groups configured. For a single address group rule, the flow is considered to belong to this rule if either the source IP or the destination IP of the data flow matches the set of IPs belonging to that address group. For a dual address group rule, both the source IP and the destination IP of the data flow must match two different address groups (address group 1 and address group 2) under that rule. Specifically, either the source IP matches address group 1 and the destination IP matches address group 2; or the source IP matches address group 2 and the destination IP matches address group 1. Furthermore, the source IP and destination IP can both match the same address group, provided they also match the other address group.

[0034] If the address group has the invert flag enabled, the result is first calculated based on the IP set of that address group, and then the result is logically inverted. For example, if the source IP is within the IP set, it is considered a miss; if the source IP is not within the IP set, it is considered a hit.

[0035] Specifically, to determine if a flow belongs to a specific rule, each rule needs to be matched sequentially. Based on the number of address groups and the inversion settings, the source IP and destination IP of the flow are verified to see if they match the corresponding rule. The first matching rule is the rule to which the flow belongs.

[0036] Traditional rule-based matching methods require traversing every address group in all rules for each flow, checking every IP network segment / range. Furthermore, within the same rule, different types of IP sets, such as single IPs, CIDRs, and IP ranges, need to be matched separately. Moreover, when IP network segments overlap or intersect, the same IP can be matched multiple times. For address groups containing multiple IP sets, such as multiple CIDR segments and multiple IP ranges, each IP set needs to be checked independently. In large-scale network environments, the number of rules can reach thousands or even tens of thousands, and the address group sets are complex, with a single address group potentially containing dozens to hundreds of IP sets. IP network segment overlap is common, often exhibiting inclusion relationships, such as 10.0.0.0 / 16 and 10.0.1.0 / 24. The same IP may be covered by address group sets from multiple rules, leading to a surge in matching counts. In the worst case, a single flow needs to check: number of rules × number of address groups × number of IP sets in each address group. Furthermore, considering the negation flag, the logical judgment becomes even more complex. The impact on performance is significant. Each flow classification requires a large number of repetitive IP range checks, which increases matching latency. CPU and memory overhead increase exponentially with rule complexity, resulting in high resource consumption. When the network scales up or rules are updated frequently, system performance drops sharply.

[0037] Traditional linear matching methods based on rules, address groups, and IP sets can lead to a large amount of redundant computation and inefficient repetitive matching in scenarios with a large number of rules, complex address group sets, and overlapping IP ranges, which seriously affects the real-time performance of network stream processing and system throughput.

[0038] In view of this, the present invention provides a fast rule matching method for traffic analysis, which transforms the complex multi-rule matching process into a simple memory lookup operation, thereby achieving high-performance network flow classification.

[0039] First, all IP sets according to the rules, such as single IPs, CIDR network segments, and IP ranges, are uniformly converted to the standard CIDR format, and a unique identifier is assigned to each address group. For each CIDR network segment, a bitmap is generated, where each bit in the bitmap corresponds to an address group ID, indicating whether the CIDR belongs to that address group. If the address group has an inverted flag, its complement CIDR is calculated and the corresponding bitmap is generated. Specifically, all CIDR network segments are organized according to prefix length to form a hierarchical structure, where shorter masked network segments are the parent set of longer masked network segments. For example, a / 16 network segment contains multiple / 24 sub-network segments. Longer masked network segments automatically inherit the tagging information of their corresponding shorter masked network segments. For example, 192.168.1.0 / 24 inherits the tagging bitmap of the 192.168.0.0 / 16 network segment. The inheritance relationship can be implemented through bitmap logic OR operations, so that the sub-network segments contain all the address group tags of the parent network segment. Each CIDR segment receives a corresponding tag bitmap, which reflects the address group to which the segment directly belongs, as well as information on all address groups inherited from it.

[0040] Next, the tag bitmaps of all CIDR network segments are aggregated into a contiguous memory region, establishing a mapping relationship between CIDRs and memory offsets. CIDRs with the same tag bitmap can share memory storage. A longest prefix matching table (LPM) is constructed, and a multi-level table structure is designed to accelerate the search. Each level entry contains a pointer to the next level table or tag memory. The next hop of the LPM table points to the memory offset of the corresponding tag bitmap, thus allowing any IP address to quickly find its longest matching CIDR network segment.

[0041] Finally, for each data stream, the LPM table is queried using both the source IP and destination IP to return the memory offset of the tag bitmap corresponding to each IP. The contiguous tag memory regions are accessed via these memory offsets to obtain the tag bitmaps corresponding to the source and destination IPs, respectively. For single-address-group rules, the corresponding address group bit in either the source or destination IP tag bitmap is checked to see if it is 1. For dual-address-group rules, the combination of the source and destination IP tag bitmaps is checked to see if it meets the condition: the source IP hits address group 1 and the destination IP hits address group 2, or the source IP hits address group 2 and the destination IP hits address group 1. The inversion logic has already been processed during the tag generation stage; therefore, only bitwise checks are needed. Finally, all rules matched by the output stream are processed.

[0042] Based on the above framework, the present invention provides a fast rule matching method for traffic analysis, comprising the following steps: 110: Retrieve configuration rules; Specifically, in the embodiments of this application, different rules can be set, and the address group in each rule can contain many different network segments. The rule can also be a single address rule or a dual address group rule, and an inversion flag can also be set.

[0043] In a single-address rule, a session is considered to have hit the rule if either the source IP or the destination IP of the session matches a network segment in the set address group.

[0044] In a dual-address rule, the source IP and destination IP of the session must each match two address groups within the same rule. A rule is considered to have been matched only if the source IP matches address group 1 of rule A and the destination IP matches address group 2 of rule A; or if both the source IP and destination IP match address group 1 or address group 2 of rule A; or if both the source IP and destination IP match address group 1 or address group 2 simultaneously.

[0045] After configuring the negation flag for the rule, the rule matching logic is as follows: if the session's IP address is in the address group, it is determined that the rule does not match; if it is not in the address group, it is determined that the rule matches.

[0046] 120: Convert the address group information in the rule configuration into a standardized CIDR network segment format and encode it using an encoding scheme; First, standardize the IP set format for rule groups. For example, convert the IP sets in the address groups of all rules to CIDR network segment format: A single IP address, such as 10.0.0.1, is converted to a / 32 subnet, 10.0.0.1 / 32. IP network segments, such as 10.0.0.0 / 16, should retain their original CIDR format.

[0047] An IP address range, such as 10.0.0.1-10.0.0.4, is converted into the smallest set of CIDR network segments that can cover that range: 10.0.0.1 / 32, 10.0.0.2 / 31, 10.0.0.4 / 32.

[0048] Next, a 4-bit binary code is assigned to each converted CIDR network segment, with the high-order bits indicating the inverted state and the low-order bits indicating the address group affiliation.

[0049] The address group flag consists of 4 bits. When the high bit is 1, it indicates that the rule setting is inverted. The low bits indicate the address group that was hit. Specifically: 0001: Represents the first address group of the rule, with an address group flag value of 01; 0010: Indicates the second address group of the rule, with an address group flag value of 02; 0011: Represents the first and second address groups of the rule, with the address group flag value being 03; 0100: This indicates that the rule is set to a single address group, and the address group flag value is 04. When the source IP or destination IP matches the 04 flag, it means that the rule is set to a single address group. 1001: Indicates that the first address group in the rule is marked as inverted, and the address group flag value is 09; 1010: This indicates that the second address group in the rule is marked as inverted, and the address group mark value is 10; 1011: This indicates that the first and second address groups of the rule are both marked as inverted, and the address group mark value is 11; 1100: This indicates that the rule is set to invert the address group flag for a single address group, and the address group flag value is 12. When different address groups contain the same CIDR network segment, they can be merged according to the mask length. Identical CIDR network segments in different address groups can be merged into a single network segment. The tag value of the merged network segment is the result of a bitwise OR operation of the tags of each address group. The merged network segment uses the minimum common mask length.

[0050] Figure 1 The diagram illustrates the encoding of address groups in the rules, as shown below. Figure 1 As shown, address group 1 of rule A: 11.0.0.1 / 24, 10.0.0.0 / 16; address group 2 of rule A: 10.0.0.0 / 16, 11.0.0.1 / 32.

[0051] Specifically, for the 11.0.0.1 / 24 network segment, this network segment belongs only to address group 1, with a tag value of 01, corresponding to binary 0001, and a record of 11.0.0.1 / 24[01, A].

[0052] For the 11.0.0.1 / 32 network segment, this network segment belongs only to address group 2, with a tag value of 02, corresponding to binary 0010, and a record of 11.0.0.1 / 32[02, A].

[0053] For the 10.0.0.0 / 16 network segment, which belongs to both address group 1 and address group 2, the tag value is 3. The corresponding binary 0011 = 01|02, the record is: 10.0.0.0 / 16[3, A].

[0054] Finally, rule A generates a list of address group information: 11.0.0.1 / 24[1, A], 11.0.0.1 / 32[2, A], 10.0.0.0 / 16[3, A].

[0055] 130: Store the encoded data as a linked list; First, all IP network segments in the rules are categorized and stored according to their mask length. An independent linked list is created for each mask length. Each linked list node contains the following information: IP network segment (CIDR format), and a list of address group information for the corresponding rule [address group tag, rule ID].

[0056] In addition, a separate inverse linked list is created, which does not store specific IP network segment information. The node content in the inverse linked list only records which rules and which address groups have their inverse flags set, in the format of [address group flag, rule ID]. The address group flag uses inverse encoding, for example, the high bit is 1, such as 09, 10, 11, 12. The rules in the inverse linked list do not have specific IP range constraints, and are applicable when no rules are matched.

[0057] Figure 2 A schematic diagram of the linked list corresponding to the rule is shown, such as... Figure 2 As shown, the left side represents the rule groups, which include four rules: A, B, C, and D. Each rule contains address groups. Rule B configures an inverted flag for address group 1, and rule C configures an inverted flag for address group 2.

[0058] First, a linked list for mask 32 is created. Rule C address group 1 contains: 10.0.0.3 / 32, and Rule D single address group contains: 10.0.0.3 / 32. Additionally, each rule includes the addresses of mask 32: 11.0.0.1 / 32 and 11.0.0.3 / 32. Therefore, the linked list for mask 32 includes nodes 11.0.0.1 / 32, 10.0.0.3 / 32, and 11.0.0.3 / 32. For node 10.0.0.3 / 32, the node information list contains [1, C] and [4, D], indicating that 10.0.0.3 / 32 belongs to address group 1 of rule C and the single address group of rule D, respectively. For node 11.0.0.1 / 32, the node information list contains: [2, A], indicating that 10.0.0.3 / 32 belongs to address group 1 of rule C. For node 11.0.0.3 / 32, the node information list contains: [1, C], indicating that 11.0.0.3 / 32 belongs to address group 1 of rule C.

[0059] In the linked list of mask 24, nodes 11.0.0.1, 9.0.0.0, and 12.0.0.0 are created. The node information list for 11.0.0.1 includes [1, A] and [9, B], indicating that 11.0.0.1 / 24 belongs to address group 1 of rule A and address group 1 of rule B, respectively, where address group 1 of rule B is the inverse. The node information list for 9.0.0.0 includes [2, B], indicating that 9.0.0.0 / 24 belongs to address group 2 of rule B. The node information list for 12.0.0.0 includes [4, D], indicating that 12.0.0.0 / 24 belongs to address group D.

[0060] In the linked list of mask 16, nodes 10.0.0.0 and 12.0.0.0 are created. The node information list for 10.0.0.0 includes [3, A] and [9, B], indicating that 10.0.0.0 / 16 belongs to address group 1 and address group 2 of rule A, and address group 1 of rule B, respectively, where address group 1 of rule B is inverted. The node information list for 12.0.0.0 includes [10, C], indicating that 12.0.0.0 / 16 belongs to address group 2 of rule C, where address group 2 of rule C is inverted.

[0061] Additionally, add two nodes to the inverted list: [09, B] and [10, C], to represent the inversion of address group 1 of rule B, and [10, C], to represent the inversion of address group 2 of rule C.

[0062] 140: For IP network segment association analysis, the long mask inherits the tagging information of the corresponding short mask; Specifically, in the IP address space, the mask length determines the size and hierarchical relationship of network segments. Short mask segments cover a larger address range, while long mask segments cover a smaller address range, completely contained within the corresponding short mask segments. Based on this hierarchical inclusion relationship, long mask segments need to inherit the tagging information of their respective short mask segments to ensure that complete rule attribution information is obtained when matching IP addresses.

[0063] The longer masked network segment inherits the tagging information of the shorter masked network segment when the following conditions are met: the address range of the shorter masked network segment completely encompasses the address range of the longer masked network segment. For example, the / 16 network segment includes all its sub-network segments such as / 24 and / 32. Therefore, the longer masked network segment retains its original tags while adding all the tags of the shorter masked network segment. During the merging process, tags for the same address group with the same rules are only retained once.

[0064] Figure 3 A schematic diagram illustrating the inheritance relationship encoded in the linked list is shown, such as... Figure 3 As shown, in the mask 24 linked list, the node information list of 11.0.0.1 / 24 includes [1, A] and [9, B]. 11.0.0.1 / 32, as the long mask of 11.0.0.1 / 24, inherits the node information list of 11.0.0.1 / 24. Therefore, the node information list of 11.0.0.1 / 32 is [2, A], [1, A], and [9, B].

[0065] In the mask 24 linked list, the node information list for 11.0.0.1 / 24 includes [1, A] and [9, B]. 11.0.0.3 / 32, as the long mask of 11.0.0.1 / 24, inherits the node information list of 11.0.0.1 / 24. Therefore, the node information list for 11.0.0.3 / 32 is [1, C], [1, A], and [9, B].

[0066] In the mask 16 linked list, the node information list for 10.0.0.0 / 16 includes [3, A] and [9, B]. 10.0.0.3 / 32, as the long mask of 10.0.0.0 / 16, inherits the node information list of 10.0.0.0 / 16. Therefore, the node information list for 10.0.0.3 / 32 is [1, C], [4, D], [3, A], and [9, B].

[0067] In the mask 16 linked list, the node information list for 12.0.0.0 / 16 includes [10, C]. 12.0.0.3 / 24, as the long mask of 12.0.0.0 / 16, inherits the node information list of 12.0.0.0 / 16. Therefore, the node information list for 12.0.0.3 / 24 is [4, D], [10, C].

[0068] In some embodiments, all CIDR segments can be sorted from shortest to longest mask length. For each short mask segment, all long mask segments contained within it are found, and the tags of the short mask segments are added to the tag set of each long mask segment. For inverted tags, the inheritance logic is the same as that of ordinary tags.

[0069] 150: Store the tagging information of all IP network segments into contiguous memory and generate an LPM table, with the next hop of each IP network segment pointing to the memory offset of the corresponding tagging information.

[0070] Specifically, the IP network segment information that has undergone tag inheritance processing is stored in contiguous memory, and an LPM (Longest Prefix Match) table is constructed to enable fast lookup of IP addresses to rule tag information.

[0071] First, the inheritance and aggregation are performed on an IP address-by-IP address basis. For each specific IP address, the following processing steps are executed: Figure 4 A schematic diagram of the code summary is shown, such as Figure 4 As shown, taking IP address 11.0.0.1 as an example, we start processing from the longest mask chain, query the 32 mask chain, find the record corresponding to 11.0.0.1, and get the initial tag: [2, A], which means that address group 2 of rule A is hit.

[0072] Next, the 24-mask linked list is checked, and the 11.0.0.0 / 24 network segment is found to contain the IP. The tags of this network segment are obtained: [1, A] and [9, B], indicating that the address belongs to address group 1 of rule A and address group 1 of rule B (inverted). [1, A] is merged with the existing [2, A] to form [3, A], which means that the address belongs to both address groups 1 and 2 of rule A. [9, B] is added as a new tag, and the current tag set is: [3, A], [9, B]. The process of traversing upwards for shorter masks continues, repeating the above inheritance process, until no network segment with a shorter mask contains the IP.

[0073] The final adjustment is performed using a negation list. The records in the global negation list are checked. The global negation list contains [1, B] and [2, C], indicating that address group 1 of rule B is negated, and address group 2 of rule C is negated. The current IP address 11.0.0.1 has a [9, B] tag, indicating that this address is in address group 1 of rule B, but this group is negated. Comparing this with [1, B] in the global negation list, it is confirmed that IP address 11.0.0.1 does not belong to address group 1 of rule B. Therefore, [9, B] and [1, B] are removed. The negation list also contains [2, C] (indicating that address group 2 of rule C is negated). IP address 11.0.0.1 does not appear in any address group of rule C. According to the negation logic, an IP address not in an address group is considered a match for the negation rule. Therefore, [2, C] is added. Finally, the tag set for the current IP address 11.0.0.1 is: [3, A], [2, C]. Before writing the processed results to the cache, they need to be sorted according to rules. For example, they can be sorted by rule numbers such as A, B, C, and D.

[0074] The processed results are stored in a cache, and the results of retrieving the dereferenced list are also stored in another cache. For example, if the content of the record corresponding to 11.0.0.1 is [3, A], [2, C], then the number of rules is 2, and the cache structure is [number of rules, tag, rule ID, ... tag, rule ID], where the length represents the number of rules involved in this IP. Figure 5 A schematic diagram of the cache structure of the encoding set is shown. 11.0.0.1 / 32 points to address 0x1000, and the address cache is [2, 3, A, 2, C]. The first 2 in [2, 3, A, 2, C] indicates the number of tags, and [3, A] and [2, C] represent the set of tags.

[0075] Finally, the LPM is refreshed, and the memory offset is stored in the next hop of the LPM. Using this memory offset and the initial pointer, the cache structure generated in the preceding steps pointing to the IP address of this network segment can be obtained. If the IP cannot hit the LPM, then the IP has hit the inverted linked list. In this case, the IP will hit all inverted address groups. Figure 6 This is a diagram illustrating the correspondence between LPM and cache structure, such as... Figure 6 As shown, the cache structure generated in the previous steps for the IP address segment can be obtained by using the memory offset stored in the next hop of the LPM.

[0076] 160: After checking the source IP and destination IP of the flow using the LPM, two sets of tag information are obtained, and correlation analysis is performed to determine the rules for flow matching.

[0077] For any network data stream, query the rule tag information that matches the source IP and destination IP respectively. For each potentially relevant rule, apply single address group or dual address group matching logic to make a judgment. Summarize all successfully matched rules as the classification result of the stream.

[0078] First, source IP and destination IP rule tag queries are performed. An LPM query is performed on the source IP address to obtain its corresponding rule tag information, and the same LPM query is performed on the destination IP address to obtain its corresponding rule tag information. The rule tag information for each IP address is organized in list form, containing several records of [tag value, rule ID].

[0079] Next, rule-by-rule matching is performed, iterating through all rules appearing in the source IP and destination IP tag sets, and judging each rule independently. For single-address group rules, if the rule is configured as a single address group, the corresponding tag value is 4 or 12, and the matching condition is: A flow is considered to belong to a rule if either the source IP's rule tagging information contains a single-address group tag, or the destination IP's rule tagging information contains a single-address group tag. Specifically, the tag value for a single-address rule is 4, and for a single-address rule to work, both the source IP and the destination IP must match the rule.

[0080] For dual-address group rule determination, if the rule is configured as a dual-address group, the following two conditions must be met simultaneously: Both the source IP and destination IP must contain the same rule's tag information; that is, both IP addresses are involved in the rule. If only one IP is involved in the rule, it is directly determined as a mismatch. The address group coverage condition is that after performing a bitwise OR operation on the tag values ​​of the source IP and destination IP for the rule, the result is greater than or equal to 3. Let the tag value of the source IP be Ms, and the tag value of the destination IP be Md. Calculate M = Ms | Md (bitwise OR operation). If M ≥ 3, the condition is satisfied.

[0081] A single address group rule requires only one of the source or destination IP addresses to match the address group. A double address group rule requires both the source and destination IP addresses to cover both address groups of the rule. The bitwise OR result of the tag value must be ≥3, meaning that the source and destination IP addresses together cover at least address group 1 and address group 2. For example, the bitwise OR result of source tag 1 (address group 1) and destination tag 2 (address group 2) is 3. The bitwise OR result of source tag 3 (matching both address groups) and any tag is ≥3.

[0082] It's important to note that during the retrieval process, it's unknown whether a matched rule is a single-address group or a dual-address group. Therefore, for any network data flow, the node information lists matching the source IP and destination IP are queried separately, resulting in node information list 1 matching the source IP and node information list 2 matching the destination IP. Node information lists 1 and 2 can be processed by bitwise OR according to the rule number. For example, if node information list 1 contains rule A, and node information list 2 also contains rule A, then a bitwise OR operation is performed on the flag values ​​containing A; a result ≥ 3 indicates that the flow matches rule A. However, if only one node information list contains rule A, then OR processing is not possible; in this case, the flag value of the single A must be equal to 4. Figure 7 A schematic diagram of the matching determination process is shown, such as... Figure 7 As shown, the source IP of the flow involves 6 rules, namely [1, B], [2, C], [4, E], [3, G], [1, H], [4, Q]; the destination IP involves 3 rules, namely [3, A], [2, B], [1, G].

[0083] The [1, B] match in the source IP indicates that the source IP matches address group 1 of rule B; the [2, B] match in the destination IP indicates that the destination IP matches address group 2 of rule B. If the two address groups match, then this flow matches rule B.

[0084] It should be noted that the destination IP involves rules [3, A], while the source IP does not have any rules with A. Therefore, an OR operation cannot be performed. Furthermore, the number 3 before A indicates that this rule is not a single-address rule, so this flow cannot hit rule A.

[0085] Figure 8 A schematic diagram of the matching determination process is shown, such as... Figure 8 As shown, the [4, E] match in the source IP indicates a single address group configuration that matches rule E. This matches the single address group matching rule. Therefore, this flow belongs to rule E. Similarly, it also matches rule Q.

[0086] The source IP match [3, G] indicates that the source IP matches address group 1 and address group 2 of rule G; the destination IP match [1, G] indicates that the destination IP matches address group 1 of rule G. This matches the double address group matching rule. Therefore, this flow belongs to rule G.

[0087] The source IP hitting [2, C] means the source IP hits address group 2 of rule C, but the destination IP does not hit rule C, so this flow does not belong to rule C. Similarly, the source IP hitting [1, H] but the destination IP not hitting, so this flow does not belong to rule H either.

[0088] Therefore, this flow matches the four rules B, E, Q, and G.

[0089] In summary, this invention supports users in setting multi-dimensional network rules according to their needs, including: Single address group / dual address group configuration: Rules can be flexibly defined as single address group (either source IP or destination IP needs to match) or dual address group (both source IP and destination IP need to match the specified address group respectively) to meet the accurate matching needs in complex scenarios.

[0090] Inverted marking mechanism: Introducing inverted logic, when the inverted option is selected, the IP address group configuration is regarded as a "missing rule", and the non-missing rule is regarded as a "hit rule", which solves the limitation of traditional classification that can only match in the positive direction.

[0091] Address group preprocessing records rule IDs and address lease tags, and summarizes all inheritable address group tag information, laying the foundation for fast matching.

[0092] It adopts a compact caching format (such as "[number of rules, tag, rule ID, ...]") to efficiently store the correspondence between network segments and rule IDs, reduce memory usage and speed up the matching process.

[0093] Using the LPM algorithm, each IP only needs to be matched once to get the result, eliminating the need for repeated matching.

[0094] like Figure 9 As shown, this embodiment of the invention provides a fast rule matching method for traffic analysis, including the following steps: 910: Based on the IP network segments in the address groups of the rule set, obtain the code corresponding to each IP network segment, the code being used to indicate the address group and rule belonging information to which the IP network segment belongs; 920: Based on the mask length of the IP network segment and the inclusion relationship between the segments, determine the encoding set corresponding to each IP network segment, store all the encoding sets in the memory area, and obtain the mapping relationship between the IP network segment and the memory offset; 930: Construct the longest prefix matching (LPM) table, wherein the entries in the LPM table are used to indicate the memory offset corresponding to the memory region; 940: In response to the received stream information, query the LPM table for the source IP address and destination IP address of the stream information respectively to obtain the memory offset, read the memory region indicated by the memory offset to obtain the encoding set that matches the source IP address and the destination IP address respectively, and determine the rule in the rule set that matches the stream information based on the encoding set.

[0095] In a specific embodiment of the present invention, obtaining the encoding corresponding to each IP network segment based on the IP network segments in the address group of the rule set includes: The encoding is performed using a bitmap, which includes four binary bits. The highest bit in the bitmap represents the inversion of the address group. If the IP address to be matched matches the IP network segment in the address group, it indicates a match; otherwise, it indicates a match. The remaining bits in the bitmap represent the address group to which the IP network segment belongs. When different rules in the rule set or different address groups in the same rule contain the exact same IP network segment, the identical IP network segments are merged into one IP network segment. The encoding of the IP network segment includes the bitwise OR operation result of the encodings of all the merged identical IP network segments.

[0096] In a specific embodiment of the present invention, determining the encoding set corresponding to each IP network segment based on the mask length of the IP network segment and the inclusion relationship between the network segments includes: IP network segments with the same mask are placed in the same first linked list to obtain at least one first linked list. Each node in the first linked list stores the IP network segment and the code corresponding to the IP network segment. Traverse all of the first linked lists, and inherit the encoding of the corresponding short-mask IP network segment from the long-mask IP network segment with an inclusion relationship, to obtain the encoding set corresponding to each IP network segment.

[0097] In a specific embodiment of the present invention, it further includes: Establish a reverse linked list, wherein the nodes of the reverse linked list record the encoding of the address group in the rule with the reverse mark, and the reverse mark is the position bit in the encoding that indicates the reverse state.

[0098] In a specific embodiment of the present invention, it further includes: Query the inverted linked list, adjust the encoding set according to the inverted code, and remove the code if the code in the encoding set points to the same rule and address group as the inverted code in the inverted linked list. If there is no code in the encoding set that corresponds to the inverted code in the inverted linked list, then the inverted code is added.

[0099] In a specific embodiment of the present invention, determining the rules in the rule set that the stream information matches based on the encoding set includes: For the single address group mode, if the encoding set of the source IP address or destination IP address of the flow information contains the encoding corresponding to the rule, then it is determined that the rule is matched; For the dual-address group mode, if the encoding sets of the source IP address and the destination IP address of the flow information both contain the encoding of the rule, then the encoding of the source IP and the encoding of the destination IP are bitwise ORed. If the result value is greater than or equal to 3, then it is determined that the rule is matched.

[0100] In a specific embodiment of the present invention, the longest prefix matching (LPM) table is constructed, including: All IP network segments are added to the LPM table. The next hop of each node in the LPM table stores the memory offset. The encoding set corresponding to each IP network segment is obtained through the memory offset and the initial pointer. The tail node in the LPM table points to the memory offset corresponding to the inverted code in the inverted linked list.

[0101] like Figure 10 As shown, this embodiment of the invention provides a fast rule matching device for traffic analysis, the device comprising: The first processing module is used to obtain the code corresponding to each IP network segment based on the IP network segments in the address group of the rule set. The code is used to indicate the address group and rule belonging information to which the IP network segment belongs. The second processing module is used to determine the encoding set corresponding to each IP network segment based on the mask length of the IP network segment and the inclusion relationship between the network segments, store all the encoding sets in the memory area, and obtain the mapping relationship between the IP network segment and the memory offset; The third processing module is used to construct the longest prefix matching (LPM) table, wherein the entries of the LPM table are used to indicate the memory offset of the corresponding memory region; The fourth processing module is used to respond to the received stream information by querying the LPM table for the source IP address and destination IP address of the stream information respectively, obtaining the memory offset, reading the memory region indicated by the memory offset, obtaining the encoding set that matches the source IP address and the destination IP address respectively, and determining the rule in the rule set that matches the stream information based on the encoding set.

[0102] In a specific embodiment of the present invention, the first processing module is used to encode using a bitmap. The bitmap includes four binary bits, wherein the highest bit in the bitmap represents the inversion of the address group, indicating that the IP address to be matched matches the IP network segment in the address group, indicating a miss, otherwise indicating a hit. The remaining bits in the bitmap represent the address group to which the IP network segment belongs. When different rules in the rule set or different address groups in the same rule contain the exact same IP network segment, the identical IP network segments are merged into one IP network segment. The encoding of the IP network segment includes the bitwise OR operation result of the encodings of all the merged identical IP network segments.

[0103] In a specific embodiment of the present invention, the second processing module is used to put IP network segments with the same mask into the same first linked list, thereby obtaining at least one first linked list, wherein each node in the first linked list stores the IP network segment and the code corresponding to the IP network segment; Traverse all of the first linked lists, and inherit the encoding of the corresponding short-mask IP network segment from the long-mask IP network segment with an inclusion relationship, to obtain the encoding set corresponding to each IP network segment.

[0104] In a specific embodiment of the present invention, the second processing module is used to establish a reverse linked list, wherein the nodes of the reverse linked list record the encoding of the address group in the rule with the reverse mark, and the reverse mark is the position bit in the encoding that indicates the reverse state.

[0105] In a specific embodiment of the present invention, the second processing module is used to query the inverted linked list, adjust the encoding set according to the inverted code, and remove the code if the code in the encoding set and the inverted code in the inverted linked list point to the same rule and address group. If there is no code in the encoding set that corresponds to the inverted code in the inverted linked list, then the inverted code is added.

[0106] In a specific embodiment of the present invention, the fourth processing module is used to determine that the rule is matched if the encoding set of the source IP address or destination IP address of the flow information contains the encoding corresponding to the rule for the single address group mode. For the dual-address group mode, if the encoding sets of the source IP address and the destination IP address of the flow information both contain the encoding of the rule, then the encoding of the source IP and the encoding of the destination IP are bitwise ORed. If the result value is greater than or equal to 3, then it is determined that the rule is matched.

[0107] In a specific embodiment of the present invention, the third processing module is used to add all the IP network segments to the LPM table. The next hop of each node in the LPM table stores the memory offset. The encoding set corresponding to each IP network segment is obtained through the memory offset and the initial pointer. The tail node in the LPM table points to the memory offset corresponding to the inverted code in the inverted linked list.

[0108] An embodiment of the invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the fast rule matching method for traffic analysis.

[0109] This invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the fast rule matching method for traffic analysis as described above.

[0110] In addition, combined Figure 9 The fast rule matching method for traffic analysis described in this embodiment of the invention can be implemented by an electronic device, such as a computer device. Figure 11 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention.

[0111] In some embodiments, the computer device may further include a communication interface 83 and a bus 80. For example, Figure 11 As shown, the processor 81, memory 82, and communication interface 83 are connected through bus 80 and complete communication with each other.

[0112] Specifically, the processor 81 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of the present invention.

[0113] The memory 82 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 81.

[0114] The processor 81 implements the fast rule matching method for arbitrary traffic analysis in the above embodiments by reading and executing computer program instructions stored in the memory 82.

[0115] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A fast rule matching method for traffic analysis, characterized in that, The method includes: Based on the IP network segments in the address group of the rule set, the code corresponding to each IP network segment is obtained. The code is used to indicate the address group and rule belonging information to which the IP network segment belongs. Based on the mask length of the IP network segment and the inclusion relationship between the segments, determine the encoding set corresponding to each IP network segment, store all the encoding sets in the memory area, and obtain the mapping relationship between the IP network segment and the memory offset; Construct a longest prefix matching (LPM) table, wherein each entry in the LPM table is used to indicate the memory offset corresponding to the memory region; In response to the received stream information, the LPM table is queried for the source IP address and destination IP address of the stream information respectively to obtain the memory offset. The memory region indicated by the memory offset is read to obtain the encoding set that matches the source IP address and the destination IP address respectively. Based on the encoding set, the rule in the rule set that matches the stream information is determined.

2. The method according to claim 1, characterized in that, The step of obtaining the encoding corresponding to each IP network segment based on the IP network segments in the address group of the rule set includes: The encoding is performed using a bitmap, which includes four binary bits. The highest bit in the bitmap represents the inversion of the address group. If the IP address to be matched matches the IP network segment in the address group, it indicates a match; otherwise, it indicates a match. The remaining bits in the bitmap represent the address group to which the IP network segment belongs. When different rules in the rule set or different address groups in the same rule contain the exact same IP network segment, the identical IP network segments are merged into one IP network segment. The encoding of the IP network segment includes the bitwise OR operation result of the encodings of all the merged identical IP network segments.

3. The method according to claim 2, characterized in that, The step of determining the encoding set corresponding to each IP network segment based on the mask length of the IP network segment and the inclusion relationship between the network segments includes: IP network segments with the same mask are placed in the same first linked list to obtain at least one first linked list. Each node in the first linked list stores the IP network segment and the code corresponding to the IP network segment. Traverse all of the first linked lists, and inherit the encoding of the corresponding short-mask IP network segment from the long-mask IP network segment with an inclusion relationship, to obtain the encoding set corresponding to each IP network segment.

4. The method according to claim 3, characterized in that, Also includes: Establish a reverse linked list, wherein the nodes of the reverse linked list record the encoding of the address group in the rule with the reverse mark, and the reverse mark is the position bit in the encoding that indicates the reverse state.

5. The method according to claim 4, characterized in that, Also includes: Query the inverted linked list, adjust the encoding set according to the inverted code, and remove the code if the code in the encoding set points to the same rule and address group as the inverted code in the inverted linked list. If there is no code in the encoding set that corresponds to the inverted code in the inverted linked list, then the inverted code is added.

6. The method according to claim 4, characterized in that, The step of determining the rules in the rule set that match the stream information based on the encoding set includes: For the single address group mode, if the encoding set of the source IP address or destination IP address of the flow information contains the encoding corresponding to the rule, then it is determined that the rule is matched; For the dual-address group mode, if the encoding sets of the source IP address and the destination IP address of the flow information both contain the encoding of the rule, then the encoding of the source IP and the encoding of the destination IP are bitwise ORed. If the result value is greater than or equal to 3, then it is determined that the rule is matched.

7. The method according to claim 4, characterized in that, Construct the longest prefix matching LPM table, including: All IP network segments are added to the LPM table. The next hop of each node in the LPM table stores the memory offset. The encoding set corresponding to each IP network segment is obtained through the memory offset and the initial pointer. The tail node in the LPM table points to the memory offset corresponding to the inverted code in the inverted linked list.

8. A fast rule matching device for traffic analysis, characterized in that, The device includes: The first processing module is used to obtain the code corresponding to each IP network segment based on the IP network segments in the address group of the rule set. The code is used to indicate the address group and rule belonging information to which the IP network segment belongs. The second processing module is used to determine the encoding set corresponding to each IP network segment based on the mask length of the IP network segment and the inclusion relationship between the network segments, store all the encoding sets in the memory area, and obtain the mapping relationship between the IP network segment and the memory offset; The third processing module is used to construct the longest prefix matching (LPM) table, wherein the entries of the LPM table are used to indicate the memory offset of the corresponding memory region; The fourth processing module is used to respond to the received stream information by querying the LPM table for the source IP address and destination IP address of the stream information respectively, obtaining the memory offset, reading the memory region indicated by the memory offset, obtaining the encoding set that matches the source IP address and the destination IP address respectively, and determining the rule in the rule set that matches the stream information based on the encoding set.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the fast rule matching method for traffic analysis as described in any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the fast rule matching method for traffic analysis as described in any one of claims 1 to 7.

Images